AI agents at work: what changes when the AI can act
Temja·July 28, 2026· 8 min read
the short version
- →A chatbot answers. An agent acts: it calls tools, sends the email, moves the money, files the ticket. The failure mode moves from wrong words to wrong actions.
- →Some of those actions are one-way doors. A bad paragraph gets edited. A payment that left, a file that was shared externally, a record that was deleted, do not come back on request.
- →Prompt injection changes species. Against a chatbot it produces a bad answer you can read. Against an agent it produces an instruction the agent may execute with your permissions.
- →The human's job changes from author to handler: delegate, watch the actions stream, and stop the wrong one in the seconds before it runs. That is a trained reflex, not a policy.
For two years, workplace AI risk mostly meant bad text: hallucinated citations, confident nonsense, leaked snippets in a prompt. Annoying, occasionally embarrassing, almost always recoverable, because a human sat between the model's output and anything real. Agents remove that seat. An agent takes a goal, plans steps, and executes them through tools: email, payments, calendars, file systems, internal APIs. The human is no longer between the AI and the consequence. The human is beside it, watching. Everything below follows from that one change.
From wrong words to wrong actions
When a chatbot fails, you get a wrong answer, and the blast radius is however far you carry that answer before checking it. When an agent fails, you get a wrong action, executed with whatever permissions the agent holds. The interesting question about any agent is therefore not how smart it is. It is what it is allowed to touch, and which of those touches can be undone.
Sort a few real actions by that test and the shape of the problem appears. Drafting a reply is reversible. Sending it to an external counterparty is not. Reading an invoice is reversible. Paying it is not. Most agent runs are chains of harmless steps with one or two one-way doors in the middle, and the whole discipline of working with agents is knowing where those doors are before the agent reaches them.
For each action, decide: could you take it back if it were wrong?
Prompt injection grows hands
Prompt injection is old news for chatbots: hide an instruction in content the model will read, and the model may follow it. What changes with agents is what following it means. An agent reads far more untrusted content than any chat window, every email it triages, every web page it summarises, every attachment it processes, and it holds tools. A hidden instruction in an invoice PDF is no longer a weird sentence in a summary. It is a candidate transfer, executed under a legitimate user's permissions, wrapped in an otherwise correct-looking run.
The attack does not look like an attack
Nothing in a poisoned run announces itself. The agent narrates confidently, most steps are genuinely correct, and the dangerous action reads like housekeeping. The tell is a mismatch between the action and the task, and only a human who knows the task can see it.
A supplier email your agent is about to process. One line is not information. It is an order aimed at the machine. Click it.
The oversight window shrinks to seconds
Document review has a rhythm measured in hours: the draft waits until someone reads it. An agent run has a rhythm measured in seconds. Tool calls stream past, each one already happening, and the one that matters is only stoppable before it executes. Oversight of an agent is therefore not a review step at the end. It is presence during the run, knowing which upcoming action is the one-way door, and pressing stop before it opens. Everyone who has run a drill knows the feeling: recognising the bad action in a debrief is easy. Catching it live, mid-stream, under time pressure, is a different skill entirely.
Injection-catch rate before and after hands-on drills, from a two-wave program. Knowing the risk is not the same as catching it live.
Train the handler, not the animal
Model-side safety work, alignment, guardrails, permission scoping, is necessary and keeps improving. But every deployed agent still ships with a human who delegates to it, supervises it, and owns its consequences, and that human's competence is the layer an organisation actually controls. The old name for this arrangement is handling. A handler does not need to know how the animal's mind works. They need to know its failure modes, read its behaviour, and hold the leash at the moments that cannot be taken back.
This is also where the EU AI Act quietly points. Article 4 requires measures that support AI-literacy development and reflect knowledge and use context. Few roles have more context to get wrong than the person supervising an agent with real permissions. Article 26 goes further for high-risk systems: oversight by people with the competence, training, and authority to intervene. For agent operators, intervene is literal. It means the stop button, pressed at the right second, and a record afterwards showing it happened.
What agent safety training actually is
- 1Teach the failure modesInjection, tool misuse, goal drift, confident wrong narration. Short lessons, concrete examples, no model internals required.
- 2Drill the stopIn a sandboxed simulator, the learner delegates a real-shaped task, the agent streams its tool calls, and a poisoned action is waiting in the run. Either they catch it or the consequence plays out in front of them.
- 3Let the miss teachA missed drill is the best lesson available: the money leaves, the confirmation is suppressed, the near-miss report writes itself. Nobody who has watched that forgets what the tell looked like.
- 4Record behaviour, not attendanceWho caught what, how fast, on which content version, in a tamper-evident log. Article 4 mandates no particular evidence file, but that record shows what the measure covered and how it performed.
The one-line shift
Chatbot-era training asked: can your people spot a wrong answer? Agent-era training asks: can your people stop a wrong action before it runs? Different question, different training, different evidence.
take these with you
- 01Agents move the failure mode from wrong words to wrong actions, and some actions are one-way doors.
- 02Prompt injection against an agent is an action-hijacking problem executed with real permissions, not a content problem.
- 03Oversight happens during the run, in seconds. That is a trained reflex, built in drills, not a review policy.
- 04The handler is the layer you control: train the person who runs the agent, and keep behaviour records that prove it.
Questions people ask
What is an AI agent, as opposed to a chatbot?
A chatbot produces text for a human to use. An agent pursues a goal by taking actions through tools: sending email, making payments, editing files, calling APIs. The defining difference is that an agent's output is an action, not an answer.
Why are AI agents riskier than chatbots at work?
Because their failures are actions executed with real permissions, and some actions cannot be undone. A wrong answer can be checked before it is used. A wrong payment, external email, or deletion has already happened.
How does prompt injection affect AI agents?
An agent reads large amounts of untrusted content, such as emails, web pages, and attachments. A hidden instruction in that content can steer the agent into executing an attacker's action under the legitimate user's permissions, which makes injection an action-hijacking attack rather than a bad-output problem.
What is agent safety training?
Training for the people who delegate to and supervise AI agents: short role-based lessons on agent failure modes, plus hands-on drills in a sandboxed simulator where the learner must stop a poisoned action mid-run. Behaviour is recorded as evidence, which supports EU AI Act Article 4 literacy duties.
Does the EU AI Act apply to AI agents?
The Act regulates AI systems by risk and use, and its duties apply to agentic systems like any other. Article 4 literacy applies to everyone operating agents at work, and Article 26 requires trained, empowered human oversight where a system is high-risk.
from reading to reflex
See what trained behaviour looks like.
The drill takes about eight minutes. No sign-up, no card. Meet the poisoned invoice and find out if you reach STOP in time.
keep reading